e199a3bd80950701aae5c74e0124d457dfd5e9f1b8a18f9979f733c99c7e220d

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 01:51

Target

e199a3bd80950701aae5c74e0124d457dfd5e9f1b8a18f9979f733c99c7e220d.dll
Size

28KB
MD5

0766c23eac12244e270c0ef830b56a10
SHA1

c4f3beb53c0c6ce9de2731f36c779372a85349c8
SHA256

e199a3bd80950701aae5c74e0124d457dfd5e9f1b8a18f9979f733c99c7e220d
SHA512

2f7728ba001780be045c0ef8311044521fd524dde22fdd43cf5bd21e32de5dbd08f2cc3d6966ffcc61e6d68f71cd43b3ffe23cafde55e41acc066a8c70723e44
SSDEEP

96:w31+l2n11FhplC7N7lM1yYBMxOB9ErQAQY:MyvrQAQ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 1972	828	rundll32.exe	28
PID 828 wrote to memory of 1972	828	rundll32.exe	28
PID 828 wrote to memory of 1972	828	rundll32.exe	28
PID 828 wrote to memory of 1972	828	rundll32.exe	28
PID 828 wrote to memory of 1972	828	rundll32.exe	28
PID 828 wrote to memory of 1972	828	rundll32.exe	28
PID 828 wrote to memory of 1972	828	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e199a3bd80950701aae5c74e0124d457dfd5e9f1b8a18f9979f733c99c7e220d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:828
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e199a3bd80950701aae5c74e0124d457dfd5e9f1b8a18f9979f733c99c7e220d.dll,#1
  2⤵
  PID:1972

memory/1972-55-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download